Terms of Service

1.1 Who we are. Okay, last one ApS, Rørholmsgade 21, 2tv, 1352 Copenhagen K, Denmark, trading as okay, last one. In these terms, "we", "us" and "our" mean that company, and "you" means the business commissioning our services.

1.2 Business customers only. We offer our services to businesses acting in a commercial capacity. We do not contract with consumers, and the statutory consumer rights that apply to consumer contracts in the EU — including the fourteen-day right of withdrawal — do not apply to these terms.

1.3 What forms our agreement. These terms apply to every quote, order and engagement. Together with the written scope we send you, they form the whole agreement between us. Where your written scope says something different from these terms, the scope wins.

1.4 How you accept them. You accept these terms by approving a written scope in writing, including by email, by paying an invoice, or by asking us to begin work.

2.1 Services. We design and build software, primarily in Lovable, including front ends, backends, authentication, payments, integrations and automations. We also do experience design, analytics and search setup, and co-build engagements alongside your own team.

2.2 What you actually get. The services described on our website are indicative. What we deliver to you is what your written scope says, and nothing beyond it.

2.3 What we are not. We are not a hosting provider, a managed service provider, a security certification body, or a legal or compliance adviser.

3.1 Scoping. We scope on one call and send you a written scope with a fixed price and an estimated timeline before any work starts. Scoping is free, and we do not invoice for a discovery phase.

3.2 Timelines are estimates. Where we say a build typically goes live in less than a month, that is a typical outcome based on our experience, not a contractual deadline. A date becomes binding only if your written scope states it as one.

3.3 Fixed scope, fixed price. The scope defines what is included. The price we quote for that scope does not move.

3.4 Changes. Anything outside the agreed scope is a change. We quote changes before we carry them out, either as a fixed addition or at our hourly rate. We will not absorb scope changes silently, and we will not bill you for them without your agreement first.

4.1 Rates. Our rate is USD 100 per hour, with a minimum engagement of USD 1,000. All prices are exclusive of VAT and any other applicable taxes or duties.

4.2 VAT. Danish VAT is added where applicable. Business customers elsewhere in the EU holding a valid VAT registration number are invoiced under the reverse charge mechanism, and are responsible for accounting for VAT in their own country. Customers outside the EU are not charged Danish VAT unless the law requires it.

4.3 Currency. Prices are quoted in USD and invoiced in DKK, converted at the rate on the invoice date. Bank charges, payment processing fees and currency conversion costs are yours.

4.4 Payment terms. Invoices are due net 14 days from the invoice date unless your scope says otherwise. Engagements above USD 5,000 may be invoiced 50% on acceptance of the scope and 50% on delivery.

4.5 Late payment. Overdue amounts carry interest at the rate set by the Danish Interest Act (renteloven), together with any reminder fees permitted by law. If an invoice remains unpaid after written notice, we may pause work and withhold handover until it is settled.

4.6 Third-party costs. Subscriptions, hosting, domains, API usage and paid third-party services are yours to pay for, in your own accounts. We will tell you what you are likely to need before we start, and we do not mark these costs up.

5.1 What it is. USD 4,000 per month, including 50 hours of build time, exclusive of VAT.

5.2 Billing. Billed monthly in advance. A first month starting mid-month is pro-rated.

5.3 Unused hours. Hours not used in a month expire at the end of that month and do not carry over.

5.4 Additional hours. Work beyond 50 hours in a month is quoted before we carry it out, or billed at our hourly rate where you have agreed to that in advance.

5.5 Cancelling. You may cancel in any month, in writing, with effect from the end of the month you have already paid for. There is no notice period beyond that and no minimum term. The current month is not refunded.

5.6 Response times. Same-day replies apply to Danish working days, within working hours. The retainer is not a 24/7 support arrangement, an on-call rota, or an uptime guarantee.

6.1 Content and materials. Copy, brand assets, images and anything else you want in the product. Content and copywriting are not included in our services unless your scope says so.

6.2 Access and a decision-maker. Timely access to the accounts, credentials, repositories and third-party services we need, and a named person who can make decisions and give approvals.

6.3 Feedback. Timely feedback and approvals. Delays on your side move the timeline, and may move the price where they cause material rework or leave us idle.

6.4 Accuracy and rights. You are responsible for the accuracy and legality of the information, data and materials you give us, and you confirm you have the rights to use them for this purpose.

6.5 Disclosure. Tell us about existing systems, integrations and dependencies, any known vulnerabilities, and any regulatory requirements that apply to your product or sector. We can only design for constraints we know about.

7.1 How we build. We build in Lovable and use AI-assisted development tools as part of our normal practice. We choose those tools and may change them during a project where it serves the outcome.

7.2 Data passing through tools. Project material may be transmitted to and temporarily stored by those tools and their subproviders, including on servers outside Denmark. Where that material includes personal data you control, section 11 governs it.

7.3 You keep the project. The Lovable project is yours at handover. You can carry on editing in the same environment we built in.

7.4 We stand behind the code. We review what we deliver, and we are responsible for the work on the same basis as any other code we write, as set out in sections 12 and 13. We do not disclaim responsibility for our own deliverables on the grounds that a tool helped produce them.

7.5 What we do not control. We are not responsible for the availability, pricing, terms or behaviour of Lovable or any other third-party platform, model or service, or for changes any of them make.

8.1 You own the deliverables. On receipt of full payment, all intellectual property rights in the deliverables created specifically for you transfer to you, to the fullest extent transferable, worldwide and without time limit. This includes the source code, designs and configuration within your scope.

8.2 Before payment. Until we have been paid in full, we retain those rights, and you hold a non-transferable licence to use the deliverables for review and evaluation only.

8.3 What handover includes. The Lovable project, repository access, credentials and environment configuration, and a written summary of what was built and where things live. There is no hostage hosting and no licence for you to renew.

8.4 Our background IP. We keep ownership of our pre-existing intellectual property, general methodologies and know-how, internal tools, templates and reusable components that were not developed specifically for you. Where any of it is embedded in your deliverables, you receive a perpetual, worldwide, non-exclusive, royalty-free licence to use, modify and distribute it as part of those deliverables.

8.5 We keep working. Nothing here stops us doing similar work for other clients, or applying the general skills, knowledge and experience we gain.

8.6 What you can do with it. After transfer you may modify the deliverables, extend them, integrate them with other systems, create derivative works and commercialise them, without further permission from us.

9.1 What is in there. Deliverables may incorporate third-party libraries, frameworks, APIs and open-source components. We use widely adopted components under permissive licences where reasonably possible.

9.2 Their licences apply. Those components carry their own licence terms, which pass to you with the deliverables. We will tell you what is included on request. After handover, continuing compliance with those licences — including any attribution or distribution requirements — is yours.

9.3 No warranty on third parties. We do not warrant the availability, performance, pricing or continued existence of any third-party component or service.

10.1 Both ways. Each of us keeps the other's non-public information confidential, and uses it only for the purposes of the engagement.

10.2 How long. This obligation survives for three years after the engagement ends, and for as long as the information remains a trade secret in the case of trade secrets.

10.3 Exceptions. It does not cover information that is or becomes public through no fault of the receiving party, was already lawfully known, was independently developed, or must be disclosed by law, court order or a competent authority.

10.4 Your own NDA. We are happy to sign yours instead. Where it conflicts with this section, yours takes precedence.

11.1 Roles. Where we process personal data on your behalf, you are the controller and we are the processor. This section 11 sets out the terms governing that processing, as required by Article 28 of the GDPR. If you need a separate standalone data processing agreement, we will sign one, and it takes precedence over this section where the two differ.

11.2 Your warranties as controller. You confirm that you have a lawful basis for the personal data you give us or ask us to process, that you have met your information obligations to data subjects, and that you have obtained any consents required.

11.3 What our GDPR review is. We enable row-level security by default on databases we build, and every build gets a GDPR review before it goes live. That review is our professional assessment of the build, not a certification, an audit, or a substitute for your own legal advice on your obligations as controller.

11.4 Subprocessors. We use service providers including Lovable, Supabase, Vercel, Stripe and Resend, together with any other provider your particular build requires. A current list is available on request. We will give you reasonable notice before adding or replacing a subprocessor, so that you can object.

11.5 Where data sits. We store data in the EU where the stack allows it. Some providers process data outside the EU and EEA. Those transfers rely on an adequacy decision by the European Commission, or on the Commission's standard contractual clauses together with any additional safeguards the circumstances require.

11.6 Data about you. Personal data we hold about you as a client — contact details, correspondence and invoicing records — is covered by our Cookie and Privacy Policy, not by this section.

11.7 Our commitments as processor. We process personal data only on your documented instructions and only for the purposes of the engagement. We keep it confidential and bind our personnel to do the same. We apply appropriate technical and organisational security measures. We assist you with data subject requests and impact assessments, charging only where the work is material. We notify you without undue delay after becoming aware of a personal data breach. We impose equivalent obligations on our subprocessors and remain responsible for them. On termination we delete or return the data at your choice, except where the law requires us to retain it. And we make available the information you reasonably need to demonstrate compliance.

12.1 Hardening is included. Every build includes hardening as part of our normal process: row-level security, rate limiting, a considered authentication model, sensible redirects and a GDPR review. What that covers for your project is described in your scope.

12.2 What it is not. Security is a process, not a state. No system is completely secure and no review finds every vulnerability. We do not warrant that deliverables are free of vulnerabilities, and we do not provide penetration testing, formal audit or certification unless separately scoped and quoted.

12.3 After handover. Ongoing security is yours: applying patches and dependency updates, monitoring, backups and disaster recovery, access control and configuration management. On a retainer, we handle the parts your scope describes.

12.4 Security defects in our work. If you report a security defect in what we delivered within 90 days of handover, and it existed at handover, was reasonably discoverable using industry-standard methods, and the deliverable has not been materially modified since, we will remediate it at no charge.

12.5 Incidents. If either of us becomes aware of a security incident affecting the other, we will notify them without undue delay, and within 24 hours where personal data may be involved.

13.1 Our warranty. We warrant that the services will be performed professionally, and with the skill and care reasonably expected of a competent studio in our field.

13.2 Defects. If a deliverable does not materially conform to the agreed scope, tell us in writing within 30 days of handover and we will correct it at no charge. This is your primary remedy for defects.

13.3 No business outcomes. We do not guarantee commercial results of any kind: revenue, users, funding, search rankings, conversion rates or growth.

13.4 No uninterrupted operation. We do not guarantee that deliverables will operate without interruption or error, or that they will remain compatible with future versions of third-party services.

13.5 Everything else excluded. Beyond 13.1 and 13.2, and to the extent permitted by law, all other warranties, express or implied, are excluded — including implied warranties of merchantability and fitness for a particular purpose.

14.1 Indirect loss excluded. Neither of us is liable to the other for indirect or consequential loss, including lost profit, lost revenue, lost or corrupted data, lost goodwill, business interruption, or third-party claims for any of those.

14.2 Cap. Our total liability for all claims arising from an engagement is limited to the fees you have paid us for that engagement. For a retainer, it is limited to the fees paid in the twelve months before the event giving rise to the claim.

14.3 Time limit. Claims must be brought within six months of the delivery or event they relate to.

14.4 What is never limited. Nothing in these terms limits liability for gross negligence, wilful misconduct, death or personal injury, or anything else that cannot be limited under Danish law.

14.5 Why these limits exist. These limitations are a deliberate allocation of risk between us, and our prices reflect them.

15.1 You cover us for. Third-party claims arising from content, data or materials you supplied, from your use or modification of the deliverables after handover, from your breach of these terms, or from your obligations as data controller.

15.2 We cover you for. Third-party claims that deliverables we created specifically for you infringe that party's intellectual property rights, provided you notify us promptly and let us conduct the defence and any settlement. This does not extend to your own modifications, material you supplied, or third-party and open-source components licensed under their own terms.

15.3 Caps apply. Each indemnity is subject to the limits in section 14, except for claims under 15.1 that result from your own breach of these terms.

16.1 Duration. A project engagement runs until handover and final payment. A retainer runs month to month.

16.2 Termination for breach. Either of us may terminate for material breach that is not remedied within 14 days of written notice.

16.3 Suspension. We may pause work where an invoice is overdue and we have given written notice, or where we cannot proceed because access, content or approvals have not arrived. The timeline shifts accordingly.

16.4 On termination. You pay for work performed up to that date. On receipt of that payment we hand over what is complete, under section 8.

16.5 Dormant projects. If a project is dormant for more than 60 days for reasons on your side, we may close it and invoice the work done. Restarting is quoted afresh.

17.1 What we may show. We may name you as a client and show the work in our portfolio and marketing, including screenshots of the delivered product.

17.2 Opting out. Tell us in writing at any time, before or after launch, and we will not publish it, or will remove it.

17.3 Confidentiality still applies. We will not disclose confidential information in doing any of this.

Neither of us is liable for delay or failure to perform caused by events beyond our reasonable control, including outages or discontinuation of critical third-party services, infrastructure failure, war, natural disaster, epidemic, industrial action or government action. Obligations are suspended while the event lasts, and either of us may terminate if it continues for more than 60 days.

19.1 Which version applies. We may update these terms. The version in force when your scope was accepted governs that engagement.

19.2 Retainers. We will give you 30 days' written notice of changes affecting a retainer. They take effect at the next monthly renewal, and you may cancel under 5.5 instead of accepting them.

20.1 Danish law. These terms are governed by Danish law, excluding the UN Convention on Contracts for the International Sale of Goods.

20.2 Talk first. We will each attempt to resolve any dispute through good-faith discussion before starting proceedings.

20.3 Venue. Failing that, disputes are subject to the exclusive jurisdiction of the Copenhagen City Court (Københavns Byret) as court of first instance.

21.1 Entire agreement. These terms and your written scope are the entire agreement between us, and supersede prior discussions and proposals.

21.2 Order of precedence. If there is a conflict: any separate data processing agreement we have signed governs data protection matters, then your written scope, then these terms.

21.3 Amendments. Changes to an accepted scope must be in writing and agreed by both of us.

21.4 Severability. If any provision is unenforceable, the rest remains in force, and the unenforceable provision is replaced by one that achieves as nearly as possible the same result.

21.5 No waiver. Failing to enforce a provision, or delaying enforcement, is not a waiver of it.

21.6 Assignment. Neither of us may assign the agreement without the other's written consent, except that we may assign it to a successor of our business.

21.7 Subcontractors. We may use subcontractors, and we remain responsible for their work.

21.8 Notices. Notices must be in writing. Email to the addresses on your scope is sufficient.

21.9 Independent parties. We are independent contractors. Nothing here creates a partnership, agency, joint venture or employment relationship.